man.dnssec-keyfromlabel.html revision 517ae3de96aaf870049c52f1224e38a85fe7f21a
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs - Copyright (C) 2004-2010 Internet Systems Consortium, Inc. ("ISC")
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs - Copyright (C) 2000-2003 Internet Software Consortium.
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs - Permission to use, copy, modify, and/or distribute this software for any
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs - purpose with or without fee is hereby granted, provided that the above
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs - copyright notice and this permission notice appear in all copies.
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs - THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs - REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs - AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs - INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs - LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs - OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs - PERFORMANCE OF THIS SOFTWARE.
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs<!-- $Id: man.dnssec-keyfromlabel.html,v 1.102 2010/12/19 01:14:06 tbox Exp $ -->
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs<meta name="generator" content="DocBook XSL Stylesheets V1.71.1">
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs<link rel="start" href="Bv9ARM.html" title="BIND 9 Administrator Reference Manual">
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs<link rel="up" href="Bv9ARM.ch10.html" title="Manual pages">
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs<link rel="prev" href="man.dnssec-dsfromkey.html" title="dnssec-dsfromkey">
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs<link rel="next" href="man.dnssec-keygen.html" title="dnssec-keygen">
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs<body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF">
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs<tr><th colspan="3" align="center"><span class="application">dnssec-keyfromlabel</span></th></tr>
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs<a accesskey="p" href="man.dnssec-dsfromkey.html">Prev</a>�</td>
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs<td width="20%" align="right">�<a accesskey="n" href="man.dnssec-keygen.html">Next</a>
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs<a name="man.dnssec-keyfromlabel"></a><div class="titlepage"></div>
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs<p><span class="application">dnssec-keyfromlabel</span> — DNSSEC key generation tool</p>
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs<div class="cmdsynopsis"><p><code class="command">dnssec-keyfromlabel</code> {-l <em class="replaceable"><code>label</code></em>} [<code class="option">-3</code>] [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>] [<code class="option">-A <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-D <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-E <em class="replaceable"><code>engine</code></em></code>] [<code class="option">-f <em class="replaceable"><code>flag</code></em></code>] [<code class="option">-G</code>] [<code class="option">-I <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-k</code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-n <em class="replaceable"><code>nametype</code></em></code>] [<code class="option">-P <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>] [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>] [<code class="option">-t <em class="replaceable"><code>type</code></em></code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-y</code>] {name}</p></div>
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs<p><span><strong class="command">dnssec-keyfromlabel</strong></span>
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs gets keys with the given label from a crypto hardware and builds
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs key files for DNSSEC (Secure DNS), as defined in RFC 2535
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs and RFC 4034.
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs The <code class="option">name</code> of the key is specified on the command
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs line. This must match the name of the zone for which the key is
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs being generated.
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs<dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs Selects the cryptographic algorithm. The value of
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs <code class="option">algorithm</code> must be one of RSAMD5, RSASHA1,
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256 or RSASHA512.
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs These values are case insensitive.
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs If no algorithm is specified, then RSASHA1 will be used by
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs default, unless the <code class="option">-3</code> option is specified,
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs in which case NSEC3RSASHA1 will be used instead. (If
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs <code class="option">-3</code> is used and an algorithm is specified,
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs that algorithm will be checked for compatibility with NSEC3.)
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs Note 1: that for DNSSEC, RSASHA1 is a mandatory to implement
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs algorithm, and DSA is recommended.
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs Note 2: DH automatically sets the -k flag.
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs Use an NSEC3-capable algorithm to generate a DNSSEC key.
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs If this option is used and no algorithm is explicitly
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs set on the command line, NSEC3RSASHA1 will be used by
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs<dt><span class="term">-E <em class="replaceable"><code>engine</code></em></span></dt>
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs Specifies the name of the crypto hardware (OpenSSL engine).
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs When compiled with PKCS#11 support it defaults to "pkcs11".
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs<dt><span class="term">-l <em class="replaceable"><code>label</code></em></span></dt>
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs Specifies the label of the key pair in the crypto hardware.
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs The label may be preceded by an optional OpenSSL engine name,
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs separated by a colon, as in "pkcs11:keylabel".
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs<dt><span class="term">-n <em class="replaceable"><code>nametype</code></em></span></dt>
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs Specifies the owner type of the key. The value of
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs <code class="option">nametype</code> must either be ZONE (for a DNSSEC
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs zone key (KEY/DNSKEY)), HOST or ENTITY (for a key associated with
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs a host (KEY)),
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs USER (for a key associated with a user(KEY)) or OTHER (DNSKEY).
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs These values are case insensitive.
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs Compatibility mode: generates an old-style key, without
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs any metadata. By default, <span><strong class="command">dnssec-keyfromlabel</strong></span>
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs will include the key's creation date in the metadata stored
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs with the private key, and other dates may be set there as well
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs (publication date, activation date, etc). Keys that include
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs this data may be incompatible with older versions of BIND; the
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs Indicates that the DNS record containing the key should have
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs the specified class. If not specified, class IN is used.
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs<dt><span class="term">-f <em class="replaceable"><code>flag</code></em></span></dt>
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs Set the specified flag in the flag field of the KEY/DNSKEY record.
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs The only recognized flags are KSK (Key Signing Key) and REVOKE.
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs Generate a key, but do not publish it or sign with it. This
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs option is incompatible with -P and -A.
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs Prints a short summary of the options and arguments to
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs <span><strong class="command">dnssec-keyfromlabel</strong></span>.
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs Sets the directory in which the key files are to be written.
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs Generate KEY records rather than DNSKEY records.
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs<dt><span class="term">-p <em class="replaceable"><code>protocol</code></em></span></dt>
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs Sets the protocol value for the key. The protocol
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs is a number between 0 and 255. The default is 3 (DNSSEC).
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs Other possible values for this argument are listed in
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs RFC 2535 and its successors.
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs<dt><span class="term">-t <em class="replaceable"><code>type</code></em></span></dt>
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs Indicates the use of the key. <code class="option">type</code> must be
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs one of AUTHCONF, NOAUTHCONF, NOAUTH, or NOCONF. The default
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs is AUTHCONF. AUTH refers to the ability to authenticate
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs data, and CONF the ability to encrypt data.
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs<dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs Sets the debugging level.
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs Allows DNSSEC key files to be generated even if the key ID
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs would collide with that of an existing key, in the event of
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs either key being revoked. (This is only safe to use if you
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs are sure you won't be using RFC 5011 trust anchor maintenance
3dec9fcdd56adf1b4a563137b4915c8f2d83b881qs with either of the keys involved.)